Debian dsa-6483 : thunderbird - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6483 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6483-1 [email protected] https://www.debian.org/securit...

CVE-2026-85197: Use After Free

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

PT-2026-85565

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

EUVD-2026-71745

An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components...

PT-2026-85685

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

Google Chrome V8 Engine Code Execution

The vulnerability in Google Chrome’s V8 JavaScript engine handler is related to type confusion errors. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code via a specially crafted HTML page...

CVE-2026-85694: Improper Control of Generation of Code

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

CVE-2025-67066

A SQL Injection vulnerability exists in oasys sysoa version 1.0 . A remote attacker can exploit the outtype parameter within the /outaddresspaging path to execute arbitrary code. The vulnerability has a CRITICAL base severity score of 9.8, with high impact on confidentiality, integrity, and avail...

PT-2026-86246

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

CVE-2026-50894

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.18. It stems from the tlsappendfrag function failing to validate the number of fragments, resulting in an out-of-bounds write that may lead to a system crash or arbitrary code execution...

MiracleLinux 9 : wget-1.21.1-11.el9_8 (AXSA:2026-1757:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1757:02 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution...

EUVD-2026-71711

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

...[ More ]

A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username...

CVE-2026-85610: Improper Control of Generation of Code

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

MongoDB Integer Overflow

The vulnerability of the MongoDB database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2025-67066: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

CVE-2026-81302: Incorrect Default Permissions

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

CVE-2026-11613: Improper Control of Filename for Include/Require Statement in PHP Program

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

CVE-2026-67397: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...